iv-org Invidious up to 2.20260626.0 Playlist Endpoint remove_video authorization

Summaryinfo

A vulnerability classified as problematic has been found in iv-org Invidious up to 2.20260626.0. The impacted element is the function remove_video of the component Playlist Endpoint. The manipulation leads to authorization. This vulnerability is uniquely identified as CVE-2026-58447. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in iv-org Invidious up to 2.20260626.0. This issue affects the function remove_video of the component Playlist Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Impacted is integrity. The summary by CVE is:

Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.

The weakness was disclosed by George Chen as 5777. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-58447 since 06/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading eliminates this vulnerability. Applying the patch 77ad41678b45c4f6815940123f1796fc51259f45 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• iv-org

Name

• Invidious

Version

• 2.20260626

License

• open-source

Website

• Product: https://github.com/iv-org/invidious/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion